IT‑IS‑Networking
Technology › Security Architecture

Packet Capture & Network Forensics

Full packet capture on the critical path, retained long enough to reconstruct an event rather than merely notice one.

Also known as Full Packet Capture, GigaStor, Viavi Observer, Network Forensics

Left to right is time. Each row is one of the 6 disciplines this one worked alongside, ordered so kindred disciplines sit next to each other rather than alphabetically — a landscape only means anything if neighboring rows belong together. Height is the work running in that domain in that year, weighted by what failure would have cost — life-safety ×3, a statutory obligation ×2.2, the estate itself ×1.5, an evaluation ×1. Every project declares which of those it was, so each ridge traces to an entry you can open and disagree with. Only the work that used this technology is counted, so what shows here is the company it kept rather than the record around it. Height and color are on the record-wide scale rather than this page’s own, so a modest estate draws a modest landscape and any two of these pages can be read against each other.

Monitoring tells you that something broke. Full packet capture tells you what was actually on the wire in the seconds before, during and after it did — which is a different question, and the only one that can be answered after the fact.

Owned across two platform generations at the City of Jacksonville: the original GigaStor probe deployment in 2009, and the 2022 upgrade onto the Viavi Observer platform with APEX, carrying more than thirty days of complete packet data across eight capture points.

Retention is the whole design. A capture platform holding a few hours is an expensive way to miss the incident you were bought for, because the interval between an event happening and somebody realizing it is worth investigating is usually measured in days.

Applied in

See also

Also searched as

  • observability
  • network performance monitoring
  • NPM
  • NDR
  • full packet capture
  • SIEM
  • SOC
  • security operations
  • incident response
  • threat detection